How to connect Claude to Gmail, with an app password.

Any mailbox that connects with a password, Gmail or any other IMAP host, one with no CardDAV server included, can bring its Google contacts with a Google sign-in of their own, from the mailbox's Connection tab in the control panel: the mail keeps its password, and a Google calendar on the same account is left as it was.

It's a second sign-in for the same reason the calendar is. The app password opens your mail and nothing else, and Google's contacts are reached through its People API, which takes a Google sign-in and refuses an app password. So your Gmail contacts are a permission you give Google directly, and you can take it back the same way.

What connecting Google contacts looks like

1. Open the mailbox in the control panel and go to its Connection tab.
2. Under If your contacts are in Google, press Connect Google contacts.
3. Choose an account. Google shows you what's being asked for before you approve anything.

Google verified Mailbox MCP for this permission on 24 September 2026, so the consent screen names the app as verified rather than warning you off it.

The button is offered on a mailbox that connects with a password and has no CardDAV address book connected. A mailbox has one address book at a time.

Google describes the permission, on its own list of scopes and on the consent screen, in these words:

That reads more alarming than what happens. Google has one read and write permission for contacts, and its description lists everything the permission could allow.

What your assistant actually does with it is decided by the permission level you give each connection. At Read only it can only find and open cards. Nothing it does deletes one until the connection is at Send and delete, and there a compliant client stops and asks you first, naming the person.

The sign-in also asks for your email address, so the control panel can show which Google account the contacts came back as. It doesn't ask for Gmail, your Drive or your calendar.

A Google calendar on the same account stays connected. Both sign-ins ask Google to add to what that account has already allowed rather than replace it, and the contacts permission is never part of the calendar's request. As with the calendar, the Google account doesn't have to be the mailbox's own address.

What your assistant can do with your Gmail contacts

The tool reference has each one with what it refuses.

We tested it on a real Google account before anybody else could connect one. On 22 September 2026, from an AI client, a card was found, opened, corrected, deleted and created again, and each step was checked at contacts.google.com before the next.

The correction changed the one field asked for, and left the name, the email address, the phone number and the company exactly as they were.

What is never stored

Nothing from your address book. A card is fetched from Google to answer the question asked, held in memory for about 10 minutes, and forgotten. A card you ask the assistant to add or correct is written to your Google contacts, and to nothing of ours.

No table, no file, no log line and no audit row carries a name, an address or a phone number.

What's kept is the permission: the token Google issued, encrypted exactly as the calendar's is, and which Google account gave it. Disconnect this address book, on the same tab, deletes it and hands the permission back to Google. The privacy policy carries Google's Limited Use terms for this data.

What reads differently from Outlook or a CardDAV book

• Google contacts are one book, named Google Contacts: Google's labels are tags on a person rather than folders, so a label is not a book of its own to search or file into.
• Google's "Other contacts", the addresses Gmail collects by itself from people you have written to, are not reached, because they sit behind a second permission that is not asked for; find_contact finds those people in the mailbox's own history instead.
• A contact's photo is never requested on Google contacts, on a look-up or a correction, and a correction leaves the photo and the labels exactly as they were.
• On Google contacts an imported card is skipped where the book already holds its first email address (Google mints the ids, as Microsoft does), a card with no email address is added every time, a group card is not imported, and the rest go to Google in batches rather than one at a time. So run a file once.
• On Google contacts the same named fields come across, each email address and phone number keeping its type; a birthday, a photo, a web address or the categories in the export do not.
• A delete reads the card again first, and is refused if it has changed since your assistant last read it, so an edit made elsewhere in the meantime stops the delete. Google has no conditional delete, so that check runs just before the delete rather than inside it. That's the one small difference from Outlook contacts and a CardDAV book.

If your address book lives somewhere other than Google, Fastmail or iCloud say, the CalDAV and CardDAV page connects it to this mailbox by its address instead.